---
title: "Whitelist an IP address for a DBaaS instance"
description: "Choose the IP addresses that can reach a MySQL, MariaDB, or PostgreSQL DBaaS instance's Endpoint, and add or remove them as your clients change."
content_type: "how-to"
product: "database"
platform: "MyAccount"
url: "/myaccount/database/how-to/whitelist-an-ip-address/"
topic: ["security-and-access"]
---

# Whitelist an IP address for a DBaaS instance

Whitelist the IP addresses your clients connect from, so that only those addresses can reach the
DBaaS instance's **Endpoint**. A whitelist helps block brute-force password and denial-of-service
attacks from unknown servers. Until you add an address, any IP address with valid credentials can
connect.

## Before you begin

You need a DBaaS instance that reads **Running**, and the public IP address each client connects
from.

## Add an address

1. On the DBaaS instance's **Whitelisted IP** tab, click **Add Whitelisted IP**.
2. Enter a valid IPv4 or IPv6 address in **IP Address**.
3. (Optional) In **Select Tags**, choose one or more of your tags to identify the entry.
4. Click **Submit**.

From then on, only the listed addresses can connect to the **Endpoint**.

## Remove an address

Removing the last entry opens the DBaaS instance to any IP address again.

1. On the DBaaS instance's **Whitelisted IP** tab, click **Remove IP** on the entry's row.
2. Click **Remove**.

While other entries remain, the removed address loses access to the **Endpoint**.

## Change an address

To change an address, add the new one first, then remove the old one, so that the whitelist keeps at
least one address throughout.

With the whitelist set, connect from one of the listed addresses; see
[Connect to a DBaaS instance](/myaccount/database/how-to/connect-to-a-database/). If a listed
address still cannot connect, see
[Troubleshooting DBaaS](/myaccount/database/troubleshooting/database/#a-connection-times-out-or-is-refused).